In short: what you keep in your own album is yours alone. A link you send can be opened by anyone who has it, and you can stop it. Add a passcode and the keepsake is locked in a way that even we cannot open.
Your album
- Only you can open it. Your keepsakes, your pages, your saved cards. No other Petra account can read them, and no other account can write into your album except to deliver a keepsake addressed to you. How it is kept: rules on the database itself, tested on every change. A stranger who guesses an address gets a refusal, not a card.
- Nobody can rewrite what was sent to you. Once a keepsake lands in your album, the sender cannot change it, take it back, or delete it. It is yours. How it is kept: the same rules. A sender may create a delivery to you and nothing more.
A link you send
- Anyone with the link can open it. That is what makes it work on WhatsApp. Treat a link like the keepsake itself: send it to the person you mean.
- Stopping a link stops all of it. Stop a link from your Sent shelf and the card, its photos and its voice note all stop opening, even for someone who saved the address earlier. If they had already kept it in their own album, that copy stays theirs. How it is kept: the link's record, its files, and the addresses of those files are all closed together.
- Add a passcode and it is locked, properly. The words, the photos and the voice are scrambled on your phone before they leave it, with a key made from your passcode. Petra never sees the passcode and cannot open the keepsake, recover it, or reset it. Lose the passcode and it is gone. How it is kept: real encryption in your browser, not a screen asking nicely.
What Petra itself can see
Honesty means saying this part too.
- Without a passcode, Petra could technically read a keepsake. Your keepsakes are protected from other people by access rules, not by encryption from us. The person who runs Petra has the keys to its database. We do not read your keepsakes, and we are working towards a record of any such access that you could see. If you want the guarantee rather than the promise, use a passcode.
- Our own notes never contain your words. When something goes wrong, the app sends us a report. That report does not carry your email address, your message, or the link to your keepsake. Our usage counts say how many cards were sent, never what they said or who sent them. How it is kept: the app strips those before anything is sent, and a test fails if it stops doing so.
- Notifications carry a name, never the words. An email or a phone alert says that someone sent you something, or opened what you sent. The message itself only ever appears inside Petra.
Where it lives
Petra runs on Google's cloud. Your keepsake records are stored in India. Photos and voice notes are stored in the United States, and the small programs that deliver reminders run there too. Crash reports go to Sentry, in the United States. Emails and phone alerts go through the usual delivery services for those.
When you leave
Delete your account and your album, your pages, your drafts and your links are permanently deleted. You choose, at that moment, whether the keepsakes you sent stay with the people you sent them to or go too. We keep a single line saying that an account was deleted on a date. It holds no name and no content.
“Private should mean private from us as well.”
The honest limits
- A link is a key. Whoever holds it can open the keepsake until you stop it. We cannot tell who has it.
- A passcode is on you. There is no reset. That is the price of a lock we cannot open.
- Analytics still sees page addresses. When someone opens a shared card, the page address includes the card's link. We are working on that.
If any line on this page stops being true, it is a bug. Tell us at privacy@petrakeepsakes.com. The full Privacy Policy has the formal version.